Overview

overview

6

Static

static

3

2026-10-02...ry.exe

windows10-2004-x64

6

2026-10-02...ry.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 11:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_61af50fa73a881f12b95b55b38c35598_elex_wannacry.exe
  • Size 404KB
  • Sample261003-nlabbaxcpd
  • SHA256 6946e661097b8d348b876fef1a714d511dd7c39c1d8b4a5aefefb8fc00dd0044
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_61af50fa73a881f12b95b55b38c35598_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_61af50fa73a881f12b95b55b38c35598_elex_wannacry.exe"
    1⤵
    • Enumerates connected drives
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:2344

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Destro
        • Path C:\ProgramData\Destro
        • Size 57B
        • SHA256 1719d3cd70af488f4df6e91429a89b3759a8fd24804573c4d79c92da7aa18805
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003122943_1.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261003122943_1.a
        • Size 2KB
        • SHA256 d1a67b5663c6fe7dd255139c22646a6494ee437847865823b1ed63cc34f03b68
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003122943_2.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261003122943_2.a
        • Size 3KB
        • SHA256 e7f6f19bac3e0a60cb9207dacd86d1e17354af43e20fdd649ad65f4dfc50a025
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003122943_3.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261003122943_3.a
        • Size 392B
        • SHA256 f400f1ab84df6dd078ec8d4157ddd3f06475cdb688b7897a922f31a02508fd50
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003122948_4.a
        • Path C:\Users\Admin\AppData\Local\Temp\~31C6\20261003122948_4.a
        • Size 273B
        • SHA256 1ad394a8a721fa9f1c8e01763400f18b29bec41f406aa56b7118f5e3bb9b86fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003122947_00000029.s
        • Path C:\Users\Admin\AppData\Local\Temp\~B4D8\20261003122947_00000029.s
        • Size 47KB
        • SHA256 a30f40e28c705a2ab470bb48d45ed2b73d31bfbbc3faf781bfdfbf5c38d72bc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        20261003123003_5.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123003_5.a
        • Size 2KB
        • SHA256 0238b602e30b695fd57fd72a7238a212291f8a4b49bb0f2b65aed838b2935352
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123006_6.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123006_6.a
        • Size 2KB
        • SHA256 63640a8dddd3ea6120139e05f7c56fd84ac98d8085c98e1645bb1ea55f82bbd2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123010_7.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123010_7.a
        • Size 2KB
        • SHA256 54ab5ab13ecc98b20a2ab4cc6be41dcbed2a5ad7fb6f92c4bb6e64c3bd17c27c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123013_8.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123013_8.a
        • Size 2KB
        • SHA256 d14fc9e59ce907bca936091dc4633e2a4af6902300f9834aeb4ae0ed6c279d13
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123016_9.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123016_9.a
        • Size 2KB
        • SHA256 9cddb7f7fb18bf3574765a869fc54a4732754638de3799d96ecb9175b2be92cc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123025_10.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123025_10.a
        • Size 2KB
        • SHA256 69723e06af83fd4c5a0812cf51fc1cae182a4ba6e2fb668af5a9656aa38380dd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123029_11.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123029_11.a
        • Size 2KB
        • SHA256 471bee7751d0a63fc79644fd42c33eaed8497a1d5238fa4f529a90a58ad0318d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123033_12.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123033_12.a
        • Size 2KB
        • SHA256 56ed7ae25338e0f8c22df38683fb8f57c7f3b3e2b6c495dfeaee695dcfc2c7fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123039_13.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123039_13.a
        • Size 2KB
        • SHA256 03f2d0df641a235958cfd4586d7bce7c8a69d8764df0ffab15e2aec6f9744f73
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123042_14.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123042_14.a
        • Size 3KB
        • SHA256 2a4d101038c97d7384617989765c3e57c8d567def263df875fc36b3382297f0c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123047_15.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123047_15.a
        • Size 3KB
        • SHA256 c7a49ecc20d47ccb7a8dd7b6432df9c2ef23faf0ddec7ae22bb16502aee89716
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123050_16.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123050_16.a
        • Size 3KB
        • SHA256 44d16b00e8a34e96a1d4689909aa1ca46d07218bcd690ac137f58cbc964bc1d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123053_17.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123053_17.a
        • Size 3KB
        • SHA256 185b327e2ea331e9e397a3fcfa336d825fad9e9b43ff5ffd5fa0661efb102344
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123057_18.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123057_18.a
        • Size 3KB
        • SHA256 a9b27788a5048d48c81b51cdd5866444696c9a6f2bf5f94b9bb450be56010300
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123100_19.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123100_19.a
        • Size 3KB
        • SHA256 94c6bcecdecd4f638de0a089530397455566bd0d2540a9fe861f038e1fca8c3f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        20261003123103_20.a
        • Path C:\Users\Admin\AppData\Local\Temp\~BB43\20261003123103_20.a
        • Size 3KB
        • SHA256 497ea9cdc96bec1640e97bfa6038090e1dcbb9198c0c6852988da314da07c46d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2344-1-0x0000000010000000-0x0000000010032000-memory.dmp
        Download

        memory/2344-0-0x0000000000400000-0x0000000000465000-memory.dmp
        Download

        memory/2344-8-0x0000000000400000-0x0000000000465000-memory.dmp
        Download